SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company wants to ensure that emails containing credit card numbers are blocked from being sent externally. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Many candidates confuse the proactive blocking capability of DLP with the reactive monitoring or classification features of communication compliance or sensitivity labels, leading them to select a wrong answer that addresses a different compliance scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policy
Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and protect sensitive data, such as credit card numbers, by scanning email content and attachments. When a DLP policy is configured to block external sharing of this sensitive information, it can automatically prevent the email from being sent, ensuring compliance with data protection regulations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels primarily classify data, applying visual markings, encryption, and access restrictions based on the label applied to a document or email. While they can enforce protection *after* classification, they do not inherently detect specific sensitive content, like credit card numbers, within an *unlabeled* email and proactively block its transmission. Their enforcement relies on the item being labeled, or an auto-labeling policy being configured, rather than real-time content inspection for blocking.
- ✗
Communication compliance
Why it's wrong here
Communication compliance is a monitoring and investigative tool designed to help organizations detect, capture, and act on inappropriate or non-compliant communications within their environment. It focuses on identifying policy violations for review by designated compliance officers, allowing for post-incident analysis and remediation. This solution does not, however, actively prevent the real-time transmission of sensitive data like credit card numbers in emails; it monitors and flags, rather than blocks.
- ✗
Information barriers
Why it's wrong here
Information barriers are implemented to prevent specific groups of users from communicating with other specific groups of users, typically to avoid conflicts of interest or maintain regulatory compliance. These barriers segment communication channels based on user attributes and group membership, restricting who can communicate with whom. They are not designed to detect and block the sharing of particular sensitive content types, such as credit card numbers, regardless of the sender or recipient groups.
- ✓
Data Loss Prevention (DLP) policy
Why this is correct
Data Loss Prevention (DLP) policies are purpose-built to identify, monitor, and protect sensitive information across various locations, including email, cloud apps, and endpoints. By utilizing sensitive information types (SITs) to detect patterns like credit card numbers, DLP policies can proactively enforce actions such as blocking an email from being sent, notifying administrators, or encrypting the content. This directly prevents the unauthorized sharing or exfiltration of sensitive data.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.